includes/shell/Shell.php

   1 <?php
   2 /**
   3  * Class used for executing shell commands
   4  *
   5  * This program is free software; you can redistribute it and/or modify
   6  * it under the terms of the GNU General Public License as published by
   7  * the Free Software Foundation; either version 2 of the License, or
   8  * (at your option) any later version.
   9  *
  10  * This program is distributed in the hope that it will be useful,
  11  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  12  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
  13  * GNU General Public License for more details.
  14  *
  15  * You should have received a copy of the GNU General Public License along
  16  * with this program; if not, write to the Free Software Foundation, Inc.,
  17  * 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.
  18  * http://www.gnu.org/copyleft/gpl.html
  19  *
  20  * @file
  21  */
  22
  23 namespace MediaWiki\Shell;
  24
  25 use Hooks;
  26 use MediaWiki\MediaWikiServices;
  27
  28 /**
  29  * Executes shell commands
  30  *
  31  * @since 1.30
  32  *
  33  * Use call chaining with this class for expressiveness:
  34  *  $result = Shell::command( 'some command' )
  35  *       ->input( 'foo' )
  36  *       ->environment( [ 'ENVIRONMENT_VARIABLE' => 'VALUE' ] )
  37  *       ->limits( [ 'time' => 300 ] )
  38  *       ->execute();
  39  *
  40  *  ... = $result->getExitCode();
  41  *  ... = $result->getStdout();
  42  *  ... = $result->getStderr();
  43  */
  44 class Shell {
  45
  46         /**
  47          * Disallow any root access. Any setuid binaries
  48          * will be run without elevated access.
  49          *
  50          * @since 1.31
  51          */
  52         const NO_ROOT = 1;
  53
  54         /**
  55          * Use seccomp to block dangerous syscalls
  56          * @see <https://en.wikipedia.org/wiki/seccomp>
  57          *
  58          * @since 1.31
  59          */
  60         const SECCOMP = 2;
  61
  62         /**
  63          * Create a private /dev
  64          *
  65          * @since 1.31
  66          */
  67         const PRIVATE_DEV = 4;
  68
  69         /**
  70          * Restrict the request to have no
  71          * network access
  72          *
  73          * @since 1.31
  74          */
  75         const NO_NETWORK = 8;
  76
  77         /**
  78          * Deny execve syscall with seccomp
  79          * @see <https://en.wikipedia.org/wiki/exec_(system_call)>
  80          *
  81          * @since 1.31
  82          */
  83         const NO_EXECVE = 16;
  84
  85         /**
  86          * Deny access to LocalSettings.php (MW_CONFIG_FILE)
  87          *
  88          * @since 1.31
  89          */
  90         const NO_LOCALSETTINGS = 32;
  91
  92         /**
  93          * Apply a default set of restrictions for improved
  94          * security out of the box.
  95          *
  96          * @note This value will change over time to provide increased security
  97          *       by default, and is not guaranteed to be backwards-compatible.
  98          * @since 1.31
  99          */
 100         const RESTRICT_DEFAULT = self::NO_ROOT | self::SECCOMP | self::PRIVATE_DEV |
 101                                                          self::NO_LOCALSETTINGS;
 102
 103         /**
 104          * Don't apply any restrictions
 105          *
 106          * @since 1.31
 107          */
 108         const RESTRICT_NONE = 0;
 109
 110         /**
 111          * Returns a new instance of Command class
 112          *
 113          * @note You should check Shell::isDisabled() before calling this
 114          * @param string|string[] ...$commands String or array of strings representing the command to
 115          * be executed, each value will be escaped.
 116          *   Example:   [ 'convert', '-font', 'font name' ] would produce "'convert' '-font' 'font name'"
 117          * @return Command
 118          */
 119         public static function command( ...$commands ): Command {
 120                 if ( count( $commands ) === 1 && is_array( reset( $commands ) ) ) {
 121                         // If only one argument has been passed, and that argument is an array,
 122                         // treat it as a list of arguments
 123                         $commands = reset( $commands );
 124                 }
 125                 $command = MediaWikiServices::getInstance()
 126                         ->getShellCommandFactory()
 127                         ->create();
 128
 129                 return $command->params( $commands );
 130         }
 131
 132         /**
 133          * Check if this class is effectively disabled via php.ini config
 134          *
 135          * @return bool
 136          */
 137         public static function isDisabled() {
 138                 static $disabled = null;
 139
 140                 if ( is_null( $disabled ) ) {
 141                         if ( !function_exists( 'proc_open' ) ) {
 142                                 wfDebug( "proc_open() is disabled\n" );
 143                                 $disabled = true;
 144                         } else {
 145                                 $disabled = false;
 146                         }
 147                 }
 148
 149                 return $disabled;
 150         }
 151
 152         /**
 153          * Version of escapeshellarg() that works better on Windows.
 154          *
 155          * Originally, this fixed the incorrect use of single quotes on Windows
 156          * (https://bugs.php.net/bug.php?id=26285) and the locale problems on Linux in
 157          * PHP 5.2.6+ (bug backported to earlier distro releases of PHP).
 158          *
 159          * @param string|string[] ...$args strings to escape and glue together, or a single
 160          *     array of strings parameter. Null values are ignored.
 161          * @return string
 162          */
 163         public static function escape( ...$args ) {
 164                 if ( count( $args ) === 1 && is_array( reset( $args ) ) ) {
 165                         // If only one argument has been passed, and that argument is an array,
 166                         // treat it as a list of arguments
 167                         $args = reset( $args );
 168                 }
 169
 170                 $first = true;
 171                 $retVal = '';
 172                 foreach ( $args as $arg ) {
 173                         if ( $arg === null ) {
 174                                 continue;
 175                         }
 176                         if ( !$first ) {
 177                                 $retVal .= ' ';
 178                         } else {
 179                                 $first = false;
 180                         }
 181
 182                         if ( wfIsWindows() ) {
 183                                 // Escaping for an MSVC-style command line parser and CMD.EXE
 184                                 // Refs:
 185                                 //  * https://web.archive.org/web/20020708081031/http://mailman.lyra.org/pipermail/scite-interest/2002-March/000436.html
 186                                 //  * https://technet.microsoft.com/en-us/library/cc723564.aspx
 187                                 //  * T15518
 188                                 //  * CR r63214
 189                                 // Double the backslashes before any double quotes. Escape the double quotes.
 190                                 $tokens = preg_split( '/(\\\\*")/', $arg, -1, PREG_SPLIT_DELIM_CAPTURE );
 191                                 $arg = '';
 192                                 $iteration = 0;
 193                                 foreach ( $tokens as $token ) {
 194                                         if ( $iteration % 2 == 1 ) {
 195                                                 // Delimiter, a double quote preceded by zero or more slashes
 196                                                 $arg .= str_replace( '\\', '\\\\', substr( $token, 0, -1 ) ) . '\\"';
 197                                         } elseif ( $iteration % 4 == 2 ) {
 198                                                 // ^ in $token will be outside quotes, need to be escaped
 199                                                 $arg .= str_replace( '^', '^^', $token );
 200                                         } else { // $iteration % 4 == 0
 201                                                 // ^ in $token will appear inside double quotes, so leave as is
 202                                                 $arg .= $token;
 203                                         }
 204                                         $iteration++;
 205                                 }
 206                                 // Double the backslashes before the end of the string, because
 207                                 // we will soon add a quote
 208                                 $m = [];
 209                                 if ( preg_match( '/^(.*?)(\\\\+)$/', $arg, $m ) ) {
 210                                         $arg = $m[1] . str_replace( '\\', '\\\\', $m[2] );
 211                                 }
 212
 213                                 // Add surrounding quotes
 214                                 $retVal .= '"' . $arg . '"';
 215                         } else {
 216                                 $retVal .= escapeshellarg( $arg );
 217                         }
 218                 }
 219                 return $retVal;
 220         }
 221
 222         /**
 223          * Generate a Command object to run a MediaWiki CLI script.
 224          * Note that $parameters should be a flat array and an option with an argument
 225          * should consist of two consecutive items in the array (do not use "--option value").
 226          *
 227          * @note You should check Shell::isDisabled() before calling this
 228          * @param string $script MediaWiki CLI script with full path
 229          * @param string[] $parameters Arguments and options to the script
 230          * @param array $options Associative array of options:
 231          *     'php': The path to the php executable
 232          *     'wrapper': Path to a PHP wrapper to handle the maintenance script
 233          * @return Command
 234          */
 235         public static function makeScriptCommand( $script, $parameters, $options = [] ): Command {
 236                 global $wgPhpCli;
 237                 // Give site config file a chance to run the script in a wrapper.
 238                 // The caller may likely want to call wfBasename() on $script.
 239                 Hooks::run( 'wfShellWikiCmd', [ &$script, &$parameters, &$options ] );
 240                 $cmd = [ $options['php'] ?? $wgPhpCli ];
 241                 if ( isset( $options['wrapper'] ) ) {
 242                         $cmd[] = $options['wrapper'];
 243                 }
 244                 $cmd[] = $script;
 245
 246                 return self::command( $cmd )
 247                         ->params( $parameters )
 248                         ->restrict( self::RESTRICT_DEFAULT & ~self::NO_LOCALSETTINGS );
 249         }
 250 }